A junior analyst has been investigating a malware outbreak and has created a detailed Timeline with a complex set of filters and queries. The analyst wants to save this work so they can continue the investigation the next day. What is the correct way to save the Timeline?

Copy the URL from the browser and bookmark it.

Use the 'Save' button in the Timeline and provide a name and description.

Export the Timeline to a PDF and save it to the local drive.

Leave the Timeline open in the browser and hope the session does not expire.

An analyst is working on a complex investigation and has created a Timeline with a specific set of filters and queries. The analyst needs to share this Timeline with a colleague who is also working on the case. What is the most appropriate way to share the Timeline?

Export the Timeline to a JSON file and email it to the colleague.

Save the Timeline and inform the colleague of its name so they can open it from the Timelines list.

Copy the Timeline's URL and send it to the colleague via chat.

Take a screenshot of the Timeline and share it in the team's chat.

What is the correct sequence of actions to save a Timeline in Elastic Security?

Add events to the Timeline, then export the Timeline to a file to save it.

Click 'New Timeline', then immediately click 'Save' without adding any data.

Create a new Timeline, add events, then close the browser tab to automatically save the Timeline.

Open the Timeline, add events, then click 'Save' and provide a name and description.

An analyst is investigating a series of alerts that suggest a user is performing reconnaissance on multiple internal systems. The analyst has a Timeline with the relevant process and network events. The analyst wants to identify all the systems the user has accessed. Which Timeline feature would be most effective for this task?

Filter the Timeline to show only events from the user's source host.

Use the 'Correlation' view to group the events by the destination host field.

Use the 'Notes' feature to manually list the destination hosts.

Create a new Timeline for each destination host and compare them.

What is the first step in a systematic investigation workflow using Timeline?

Group events by host name to identify patterns.

Save the Timeline with a descriptive name.

Create a new Timeline and add the initial event or alert that triggered the investigation.

Pivot to related events to expand the investigation.

ElasticCertified SIEM Analyst

Domain 6Objective 5

Correlate Relevant Data Using Timeline ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 3)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

20questions here

4free pages

5concepts

Questions 11–15

11application · medium
A junior analyst has been investigating a malware outbreak and has created a detailed Timeline with a complex set of filters and queries. The analyst wants to save this work so they can continue the investigation the next day. What is the correct way to save the Timeline?
Select an answer first
12application · medium
An analyst is working on a complex investigation and has created a Timeline with a specific set of filters and queries. The analyst needs to share this Timeline with a colleague who is also working on the case. What is the most appropriate way to share the Timeline?
Select an answer first
13foundation · easy
What is the correct sequence of actions to save a Timeline in Elastic Security?
Select an answer first
14expert · hard
An analyst is investigating a series of alerts that suggest a user is performing reconnaissance on multiple internal systems. The analyst has a Timeline with the relevant process and network events. The analyst wants to identify all the systems the user has accessed. Which Timeline feature would be most effective for this task?
Select an answer first
15foundation · easy
What is the first step in a systematic investigation workflow using Timeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.